Section 12 — Instruments and Controls

Testing of Protective Instrumentation Systems

IPE Engineering Practice IPE-EP-12-10-2

Document number: IPE-EP-12-10-2 · Section: 12 — Instruments and Controls

SCOPE

• This Practice details the requirements for the testing of protective instrumentation systems. Design of protective instrumentation systems are covered in EP 12–10–1.
• The testing of conventional pressure relief valves, electrical protection relays, and mechanical overspeed trips are not covered by this Practice.
• Any deviations from this Practice must be approved by the procedure given in EP 1–1–3.
• A revision bar indicates all changes made to this Revision.

2.0 REFERENCES

The latest edition of the following standards and publications are referred to herein, and shall be used with this Practice.

STANDARDS AND PUBLICATIONS

DEFINITIONS

• Responsible Post/Person - The post/person nominated by the Senior Operating Manager to carry out the Protective Instrument Systems testing program.
• Senior Operating Manager - The person appointed and responsible for the safety and operation of a particular plant.
• Reliability Analysis - A mathematical technique for assessing in probability terms the performance of a component or system.
• Triple Modular Redundant (TMR) - A system that employs three isolated, parallel control circuits. The system uses two–out–of three voting to provide high integrity, error–free, uninterrupted process operation with no single point of failure.
• Owner’s Engineer - A Inflection Point Engineering, LLC appointed engineer.
• Owner - Inflection Point Engineering, LLC.
• Protective Instrumentation - Instrumentation provided to prevent losses of all kinds, particularly in process upsets or emergencies, as distinct from instrumentation provided for normal process control.

CATEGORIZATION

• All protective instrumentation systems shall be assigned one of the Categories described in EP 12–10–1.

INSPECTION AND TESTING

• Testing of protective instrument systems shall be performed in a comprehensive manner. Each test should confirm that every component of the system functions as specified in the engineering design. Written test procedures shall be prepared for Category 1 systems and shall specify in detail the tests to be performed and the appropriate acceptance criteria. Written test procedures shall be prepared for category 2 systems.
• The Senior Operating Manager shall nominate a Responsible Post/Person for the plant, who shall be responsible for the following.
• Preparation of a test program for all protective instrumentation to ensure their regular testing at the specified frequencies. (The schedule may be drawn up by an appointed committee composed of Operations, Maintenance and Management functions).
• Preparation of detailed test procedures for the comprehensive testing of each protective system.
• Monitoring the implementation of the test program and results of the trip tests.
• Notifying the Senior Operating Manager of any failure to fulfill the requirements of the test programs and advising corrective action.

TEST PROGRAM

• A test program shall be prepared which specifies the test procedures, frequency and scheduled test dates for protective instrumentation system. In preparing this program the Responsible Person shall take account of the following:
• Specified test frequencies
• Design recommendations.
• Manufacturers recommendations.
• Refining Practices, National Standards or Codes.
• Chemical Practices, National Standards or Codes.
• Operating experience.
• Recorded test and failure rate data.
• Preparation of the test schedule the Responsible Person should consult the Operating Department to determine preferences for the timing of trip tests.
• The availability of equipment for testing shall not be compromised for operational convenience. Should this occur the Responsible Person shall notify the Senior Operating Manager, who shall ensure that all protective instrumentation systems are made available for testing at the specified test frequencies.
• Testing of protective instrumentation systems shall be carried out under the supervision of the Responsible Person. The Responsible Person shall ensure that technicians are qualified or certified as competent to carry out the testing program.

PREPARATION OF TEST PROCEDURES

• All procedures written for a plant shall follow a similar format and style, and present information and instructions in a simple, clear, and concise manner.
• Each procedure shall be comprehensive, and require minimal reference to other documents. If required, referenced data from other sources shall be clearly identified.
• Each procedure should have a unique identification number, issue number, and date. The procedure shall be specific to each particular protective instrumentation system and account for all factors relevant to the location, duty and action of that system. The specific procedure may call up standard documents for performance of routine tasks.
• Each procedure shall identify and address safety considerations, protective clothing, permits, test equipment, isolation procedures and precautions necessary to carry out the test in a safe manner.
• Inhibits for on line testing shall be identified and require authorization by the Operating Authority before operation.
• A brief summary of the system tests shall be included to ensure that the person conducting the test and the process operators understand the full scope of the work.
• Calibration data necessary for the tests shall be included in the procedure or the source of the authorized data shall be clearly identified.
• Where a system or test method is complex the procedure should contain step by step instructions.
• Procedures for the testing of multi–channel or voting systems shall ensure that all permutation of the inputs and outputs are tested. Particular attention should be paid to this requirement for software based systems.
• A report form should be included with the procedure.
• The steps necessary to reinstate the system to normal operation shall be identified in the procedure, including de–isolation, removal of any inhibits, and informing operations.
• The procedure shall indicate who must be informed if it becomes impossible to reinstate the trip system within the expected time.

APPROVAL, CONTROL AND USE OF TEST PROCEDURES

• The issue and use of test procedures should be controlled and periodically reviewed.
• The Senior Operating Manager shall agree to the test procedures and shall commit the resources for the testing.
• Test procedures should be thoroughly checked for accuracy and practicality before issue. This can be achieved through review by first line supervision and the persons conducting the tests.
• Copies of procedures should be limited to the minimum required by the operating and maintenance organization. Unofficial copying and use of procedures should be prohibited to prevent potential use of out of date or inaccurate procedures.

• Persons carrying out testing shall report to the unit supervisor who will then ensure that the persons responsible for operating the unit are aware of the testing.
• Persons carrying out trip testing should be issued a copy of the procedure or be clearly instructed where to obtain an authorized copy. The maintenance management system should clearly indicate which procedure should be followed when performing the work.
• The maintenance reporting system should require written feedback of the results of the trip test and comments on the accuracy and practicality of the test procedure.
• The Responsible Person should review the test procedures periodically. The review should consider any modifications that have been requested, recorded test results and failures, comments from the testers and changes to operating conditions.

REVIEW OF TEST PROGRAM PROGRESS

• The Responsible Person shall periodically review the progress of protective instrumentation testing against the test frequency. If testing can not be completed within the specified time period, the Senior Operating Manager shall be informed and corrective action agreed. Protective instrumentation testing shall not be deferred without the written approval of the Senior Operating Manager.
• A particular area where this may be a potential problem is the testing of final elements, e.g., emergency shutdown valves. Where it is identified that it is impossible to achieve the specified test frequency during normal plant operations, a review of the system reliability shall be carried out to confirm that the safety of plant, equipment, and personnel is not compromised.

TEST FREQUENCIES

• The purpose of this section is to identify factors that should be taken into consideration when test frequencies are specified.
• The maximum inspection and test frequency for protective instrumentation is set by EP 15–4–1.
• Changing or extending the test frequencies for Category 1 and Category 2 applications require special attention. The effect of prolonging test intervals on system reliability should be considered. In some cases, system modifications should be made to enable partial testing. This may reduce the risks to an acceptable level, and shall be confirmed through the management of change program, IPE Engineering Services PSM Manual.
• The consequences of failure of each instrument or system should be considered when specifying the initial and subsequent test frequencies.
• Test frequencies for Category 1 systems shall be entered into the Register of Pressure Relieving Systems per EP 3–7–3.

TRIP SETTING AND RE–SETTING

• Initial trip settings are assigned with regard to the process and operating conditions. It is essential that trip settings are far enough away from the normal operating conditions to minimize nuisance trips. The trip setting shall be sufficiently inside the maximum design conditions of the equipment to ensure that any trip initiated has sufficient time to operate and bring the equipment into a safe condition before design conditions are exceeded.

• Once allocated, trip settings shall not be altered without proper review and approval. Review and approval shall be in accordance with management of change program, IPE Engineering Services PSM Manual.
• Due to the variety of trip systems it is not proposed to give a list of items that must be taken into account for the initial trip setting. The initial trip setting will result from the design studies and calculations carried out.
• The initial trip setting should account for the measurement accuracy, to ensure any inaccuracies are such that the trip system still operates within the design parameters of the plant.
• The initial setting and any modifications of the setting for Category 1 systems shall be entered into the Register of Pressure Relieving Systems, EP 3–7–3. Trip settings for Category 2 and 3 systems shall be entered in the test program by the Responsible Person. Where trip settings are being done by a project team/designer, then the project team/designer should keep a list of trip settings by instrument tag number for handover to the Responsible Person. Documentation supporting the trip point should be provided for all categories.
• The trip setting list should be maintained up to date by the Responsible Person.

DISARMING AND OVERRIDING TRIPS

• The operational use of overrides should be rigorously controlled, and they should only be used for the intended purpose (e.g., maintenance). The override and disarm function should be designed to be annunciated in the operations control room so that it cannot be left in inadvertently.
• When overrides and disarming functions are used for maintenance purposes their use should be logged in and out, controlled under a permit system, and clearly identified to the operator.
• The use of such disarm and override functions, (including jumpers), is to be discouraged. Where their use on a regular basis is required then a correctly engineered solution should be considered to eliminate the need for such temporary overrides.
• There are three types of override and disarming functions:
• Those designed into the system for a particular purpose, e.g., startup. These functions will be dealt with by the designer and precise instructions for the use of the override should be available.
• Those permanently installed to allow maintenance work to take place.
• Those which are temporarily installed at the time of testing.
• The retro fitting of any trip override should be seen as a modification to the trip system and shall be done in accordance with IPE Engineering Services PSM Manual.

CATEGORY 1 INSPECTION AND TESTING

• If on–line testing of the system is required a complete system of at least a single sensor, logic system, actuator and trip valve shall remain in commission during testing.
• Software, if used, shall be checked before initial start up or before implementation of modifications. Check–out shall not be done by the software developer. Independent verification is required.

• All of the functions of the protective system shall be checked by using sensors and final elements before the initial start–up or before start–up of modifications and at regular intervals as specified by the Reliability Analysis.

CATEGORY 2 INSPECTION AND TESTING

• Category 2 systems with multiple sensors, logic, and trip valves shall be tested as for Category 1 systems.
• Software, if used, shall be checked before initial start up or before implementation of modifications. Check–out should not be done by the software developer. Independent verification is recommended.
• All of the functions of the protective system shall be checked by using sensors and final elements before the initial start–up or before start–up modifications and at regular intervals as specified by the testing frequency.

CATEGORY 3 INSPECTION AND TESTING

• Category 3 sensors can normally be tested on line.
• Testing on line of final actuator devices is not normally required. An adequate level of integrity can normally be achieved by testing at plant shutdown.

© 2026 Inflection Point Engineering, LLC. All rights reserved.